Get the last n distinct fields, or n random fields

[brettcave]

Is there an aggregation function (e.g. via stats or chart) that is a sort of combination of last and list? I want to get the 20 most recent occurences of a field, or 20 rand values of a field:

eventtype="WebAnalytics" | stats limited_list(SessionID, 20)

Some how get the first 20 or last 20 session IDs. "top" gets close to it, but I don't necessarily want to use the most commonly occurring fields, so its a type of search I could add in a ... | dedup SessionID | last_list...

[brettcave · Accepted solution]

found head and can use this with sort